Fix parsed token value with header `Authorization token=`.

Related issue: #14846

With header `Authorization: Token token=`, we get token value as `nil` instead of `token`.

The current implementation with `params.shift.last` or `param.last` assume `params` or `param` is a two-elements array. But with malformed request, they are not, so instead of `last`, we should use `[1]`

cc @simonbnrd @robin850
@arthurnn Good catch. I was doing some tests on normal authorization parsing, and forgot to remove that key-value pair. Would you want me send another PR?